@rebasepro/cms 0.17.3 → 0.18.0

package/dist/util/propertyConfigMapper.d.ts

@@ -10,7 +10,7 @@ import type { CollectionPropertyConfig } from "@rebasepro/ui";
 /**
  * Convert a single Property to a CollectionPropertyConfig.
  */
-export declare function mapPropertyToConfig(property: Property): CollectionPropertyConfig;
+export declare function mapPropertyToConfig(property: Property, key?: string): CollectionPropertyConfig;
 /**
  * Convert a Properties record to a CollectionPropertyConfig record.
  */

package/dist/util-CfLFggP7.js

@@ -0,0 +1,57 @@
+//#region src/preview/util.ts
+/**
+* The schemes a preview link may use — everything else becomes `about:blank`.
+*
+* An allowlist, because the blocklist it replaces could be walked around and
+* the walk-arounds are not exotic. Browsers strip tabs, newlines and carriage
+* returns from a URL before parsing the scheme, so `java\tscript:alert(1)` and
+* `java%0ascript:…` navigate exactly as `javascript:` does while matching none
+* of the names a blocklist knows. A leading control character does the same.
+*
+* Turned around, none of that matters: a string is either one of these four
+* schemes or it is not a link this panel will follow. `mailto:` and `tel:` are
+* here because a contact field is an ordinary thing to preview; `data:` is not,
+* even for images — a preview renders an `<img>` from its own value rather than
+* navigating to one.
+*
+* Relative URLs are allowed and deliberately: a preview commonly holds
+* `/uploads/x.png`, and a string with no scheme cannot carry one.
+*/
+var ALLOWED_URL_SCHEMES = /* @__PURE__ */ new Set([
+	"http:",
+	"https:",
+	"mailto:",
+	"tel:"
+]);
+function sanitizeUrl(url) {
+	if (!url) return "about:blank";
+	const trimmed = url.trim().replace(/[\u0000-\u001F\u007F]/g, "");
+	if (!trimmed) return "about:blank";
+	if (!/^[a-z][a-z0-9+.-]*:/i.test(trimmed)) return trimmed;
+	try {
+		const parsed = new URL(trimmed, "https://example.invalid");
+		return ALLOWED_URL_SCHEMES.has(parsed.protocol) ? trimmed : "about:blank";
+	} catch {
+		return "about:blank";
+	}
+}
+function getThumbnailMeasure(size) {
+	if (size === "small") return 40;
+	else if (size === "medium") return 100;
+	else if (size === "large") return 200;
+	else throw Error("Thumbnail size not mapped");
+}
+function getPreviewSizeFrom(size) {
+	switch (size) {
+		case "xs":
+		case "s": return "small";
+		case "m": return "medium";
+		case "l":
+		case "xl": return "large";
+		default: throw Error("Missing mapping value in getPreviewSizeFrom: " + size);
+	}
+}
+//#endregion
+export { getThumbnailMeasure as n, sanitizeUrl as r, getPreviewSizeFrom as t };
+
+//# sourceMappingURL=util-CfLFggP7.js.map

package/dist/util-CfLFggP7.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util-CfLFggP7.js","names":[],"sources":["../src/preview/util.ts"],"sourcesContent":["import { CollectionSize } from \"@rebasepro/cms-types\";\nimport type { PreviewSize } from \"../types/components/PropertyPreviewProps\";\n/**\n * The schemes a preview link may use — everything else becomes `about:blank`.\n *\n * An allowlist, because the blocklist it replaces could be walked around and\n * the walk-arounds are not exotic. Browsers strip tabs, newlines and carriage\n * returns from a URL before parsing the scheme, so `java\\tscript:alert(1)` and\n * `java%0ascript:…` navigate exactly as `javascript:` does while matching none\n * of the names a blocklist knows. A leading control character does the same.\n *\n * Turned around, none of that matters: a string is either one of these four\n * schemes or it is not a link this panel will follow. `mailto:` and `tel:` are\n * here because a contact field is an ordinary thing to preview; `data:` is not,\n * even for images — a preview renders an `<img>` from its own value rather than\n * navigating to one.\n *\n * Relative URLs are allowed and deliberately: a preview commonly holds\n * `/uploads/x.png`, and a string with no scheme cannot carry one.\n */\nconst ALLOWED_URL_SCHEMES = new Set([\"http:\", \"https:\", \"mailto:\", \"tel:\"]);\n\nexport function sanitizeUrl(url: string | undefined): string {\n    if (!url) return \"about:blank\";\n\n    // The characters a browser removes before it decides what the scheme is.\n    // Stripped here for the same reason, so this function is looking at the\n    // string the browser will act on rather than the one it was handed.\n    //\n    // The control characters are the point, so the rule that objects to them is\n    // off for this line rather than the expression rewritten to hide them from\n    // it: `java\\tscript:` and `java\\nscript:` are the bypasses this exists to\n    // close, and a regex that cannot name a control character cannot remove one.\n    // eslint-disable-next-line no-control-regex\n    const trimmed = url.trim().replace(/[\\u0000-\\u001F\\u007F]/g, \"\");\n    if (!trimmed) return \"about:blank\";\n\n    // No scheme at all — a relative link, which cannot navigate anywhere the\n    // page could not already reach.\n    if (!/^[a-z][a-z0-9+.-]*:/i.test(trimmed)) return trimmed;\n\n    try {\n        // `new URL` normalizes percent-encoding and case, so\n        // `JaVaScRiPt%3aalert(1)` is judged as what it resolves to. The base is\n        // there only so a protocol-relative `//host/path` parses.\n        const parsed = new URL(trimmed, \"https://example.invalid\");\n        return ALLOWED_URL_SCHEMES.has(parsed.protocol) ? trimmed : \"about:blank\";\n    } catch {\n        return \"about:blank\";\n    }\n}\n\nexport const SMALL_THUMBNAIL = 40;\nexport const MEDIUM_THUMBNAIL = 100;\nexport const LARGE_THUMBNAIL = 200;\n\nexport function getThumbnailMeasure(size: PreviewSize): number {\n    if (size === \"small\")\n        return SMALL_THUMBNAIL;\n    else if (size === \"medium\")\n        return MEDIUM_THUMBNAIL;\n    else if (size === \"large\")\n        return LARGE_THUMBNAIL;\n    else throw Error(\"Thumbnail size not mapped\");\n}\n\nexport function getPreviewSizeFrom(size: CollectionSize): PreviewSize {\n    switch (size) {\n        case \"xs\":\n        case \"s\":\n            return \"small\";\n        case \"m\":\n            return \"medium\";\n        case \"l\":\n        case \"xl\":\n            return \"large\";\n        default:\n            throw Error(\"Missing mapping value in getPreviewSizeFrom: \" + size);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoBA,IAAM,sCAAsB,IAAI,IAAI;CAAC;CAAS;CAAU;CAAW;AAAM,CAAC;AAE1E,SAAgB,YAAY,KAAiC;CACzD,IAAI,CAAC,KAAK,OAAO;CAWjB,MAAM,UAAU,IAAI,KAAK,CAAC,CAAC,QAAQ,0BAA0B,EAAE;CAC/D,IAAI,CAAC,SAAS,OAAO;CAIrB,IAAI,CAAC,uBAAuB,KAAK,OAAO,GAAG,OAAO;CAElD,IAAI;EAIA,MAAM,SAAS,IAAI,IAAI,SAAS,yBAAyB;EACzD,OAAO,oBAAoB,IAAI,OAAO,QAAQ,IAAI,UAAU;CAChE,QAAQ;EACJ,OAAO;CACX;AACJ;AAMA,SAAgB,oBAAoB,MAA2B;CAC3D,IAAI,SAAS,SACT,OAAA;MACC,IAAI,SAAS,UACd,OAAA;MACC,IAAI,SAAS,SACd,OAAA;MACC,MAAM,MAAM,2BAA2B;AAChD;AAEA,SAAgB,mBAAmB,MAAmC;CAClE,QAAQ,MAAR;EACI,KAAK;EACL,KAAK,KACD,OAAO;EACX,KAAK,KACD,OAAO;EACX,KAAK;EACL,KAAK,MACD,OAAO;EACX,SACI,MAAM,MAAM,kDAAkD,IAAI;CAC1E;AACJ"}